virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

Make sure offsets of mjpeg b are within the buffer.

Browse Source 
Fixes issue1132

Originally committed as revision 18996 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Michael Niedermayer 2009-05-30 10:04:09 +00:00
parent c40f366372
commit ff8c65f482
1 changed files with 14 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavcodec/mjpegbdec.c
View File

@ -28,6 +28,14 @@
#include "mjpeg.h" #include "mjpeg.h"
#include "mjpegdec.h" #include "mjpegdec.h"
static uint32_t read_offs(AVCodecContext *avctx, GetBitContext *gb, uint32_t size, const char *err_msg){
uint32_t offs= get_bits_long(gb, 32);
if(offs >= size){
av_log(avctx, AV_LOG_WARNING, err_msg, offs, size);
return 0;
}
return offs;
}
static int mjpegb_decode_frame(AVCodecContext *avctx, static int mjpegb_decode_frame(AVCodecContext *avctx,
void *data, int *data_size, void *data, int *data_size,
@ -64,10 +72,10 @@ read_header:
field_size = get_bits_long(&hgb, 32); /* field size */ field_size = get_bits_long(&hgb, 32); /* field size */
av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\n", field_size); av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\n", field_size);
skip_bits(&hgb, 32); /* padded field size */ skip_bits(&hgb, 32); /* padded field size */
second_field_offs = get_bits_long(&hgb, 32); second_field_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "second_field_offs is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\n", second_field_offs); av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\n", second_field_offs);
dqt_offs = get_bits_long(&hgb, 32); dqt_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dqt is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\n", dqt_offs); av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\n", dqt_offs);
if (dqt_offs) if (dqt_offs)
{ {
@ -76,7 +84,7 @@ read_header:
ff_mjpeg_decode_dqt(s); ff_mjpeg_decode_dqt(s);
} }
dht_offs = get_bits_long(&hgb, 32); dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\n", dht_offs); av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\n", dht_offs);
if (dht_offs) if (dht_offs)
{ {
@ -85,7 +93,7 @@ read_header:
ff_mjpeg_decode_dht(s); ff_mjpeg_decode_dht(s);
} }
sof_offs = get_bits_long(&hgb, 32); sof_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\n", sof_offs); av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\n", sof_offs);
if (sof_offs) if (sof_offs)
{ {
@ -95,9 +103,9 @@ read_header:
return -1; return -1;
} }
sos_offs = get_bits_long(&hgb, 32); sos_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sos is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\n", sos_offs); av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\n", sos_offs);
sod_offs = get_bits_long(&hgb, 32); sod_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
if (sos_offs) if (sos_offs)
{ {